Records of Processing Activities
A record of processing activities (ROPA) is an internal inventory of what personal data you handle and how. Many organisations are required to keep one, and it is good practice for everyone.
This is general guidance on what a ROPA contains and why it helps.
What to Record
- The purposes of your processing.
- The categories of people and data involved.
- Who you share data with.
- Any transfers outside the UK.
- Retention periods and security measures.
Who Must Keep One
Organisations with 250 or more staff must keep a ROPA. Smaller organisations must too where processing is regular, risky, or involves special category data — which in practice covers most businesses.
Why It Pays Off
A good ROPA makes everything else easier: drafting privacy notices, answering rights requests and demonstrating accountability if the ICO asks. It is the map of your data landscape, and most organisations are surprised by how much data they actually hold once they write it all down.
Keeping It Alive
A ROPA is only useful if it stays current. Review it whenever you adopt a new tool, change a supplier or launch a new activity, and assign someone clear responsibility for keeping it up to date. A spreadsheet is perfectly adequate for most smaller organisations.
Frequently Asked Questions
Does a small business really need a ROPA?
If your processing is regular, involves sensitive data or carries risk — which covers most businesses — then yes. Even where not strictly required, it is valuable groundwork.
If you need a hand with any of this, your Progressive Robot delivery team is ready to help. Raise a ticket from the Support area of your client portal or speak to your account manager and we will guide you through the next steps.